Privacy policy

• To filter out abnormal request volume and keep the service stable.
• To count how often each page is opened so we can improve the layout.
• To block unauthorized access to the admin screens and keep an operations record.

We do not collect names, phone numbers, postal addresses, or payment details, and there is no web inquiry form.

• IP address: held as the key of a request-rate counter for about one minute, then removed automatically.
• Visit records: kept as daily counters for 180 days, then deleted automatically.
• Random browser identifier: stays in your browser and you can delete it yourself. The server-side totals are deleted after 180 days.
• Banner view and click counts: kept as running totals with no personal identifier attached.
• Operations audit trail: admin actions are stored in a form that cannot be edited or deleted. It records the admin account identifier and the event name only. IP addresses are not recorded.
• Admin account data: kept until the account is deleted.

• Opening, resizing, compositing, and exporting all happen inside your browser.
• Images are never sent to a server. No copy is stored, and operators cannot see them.
• Session storage keeps only the layout (chosen device, background, finish). The image itself is not stored, so you upload it again on your next visit.

• We do not share or sell collected data to third parties.
• Visit statistics are collected in-house, with no external analytics tool attached.
• The servers and network needed to run the service are provided by a hosting company.

• No cookies are used during ordinary visits.
• Local storage holds one random value used to count distinct visitors.
• Session storage holds one editor layout. It disappears when you close the tab.
• Clearing site storage in your browser removes those values immediately. It does not affect how the service works.
• Session and CSRF cookies are set only when an operator signs in. Both use SameSite=Strict, plus Secure over HTTPS. HttpOnly applies to the session cookie only: the CSRF cookie has to be readable by the browser so its value can be sent back with each request.

• You may ask to access, correct, delete, or suspend processing of your data. Requests sent to the contact address below are handled without delay.
• Because the collected items do not point to a specific person, verifying identity may be difficult. Telling us the scope of your request helps us explain the verification steps.
• The random browser identifier is removed the moment you clear browser storage.

• Items past their retention period are removed automatically by storage expiry. There is no separate manual destruction step.
• To prevent tampering, the operations audit trail is not deleted. The only personal item it holds is the admin account identifier.

• The admin address of this tool redirects to the admin screen of the main site, which opens only after sign-in.
• Admin passwords are stored as hashes and external service keys are stored encrypted.
• Traffic is served over HTTPS with security headers and request-rate limits.
• Admin actions are written to an audit trail that cannot be edited or deleted.

• No third-party personalized advertising is served. Banners shown on the site are run by us and only their view and click totals are counted.
• If third-party advertising is introduced later, this policy will state whether cookies or identifiers are used. The change will be announced in advance.

Privacy officer: info@sudev.co.kr

• Personal Information Dispute Mediation Committee 1833-6972 (www.kopico.go.kr)
• Privacy Infringement Report Centre 118 (privacy.kisa.or.kr)
• Supreme Prosecutors Office Cyber Investigation Division 1301
• National Police Agency Cyber Bureau 182

Any change is posted on this page together with its effective date. If the items collected or the retention periods change, that is stated as well.